All Questions
16 questions
0
votes
1
answer
623
views
How does winrar know I typed the right key?
As far as I know WinRar uses the password you type and derives the key from it. But how exactly does it check if the key I typed is correct? What I think is that it compares your guess with the right ...
- 113
2
votes
2
answers
488
views
Why is it still necessary to block brute-force attacks when passwords hash verification requires significant work?
For authentication controls, Owasp gives advice to prevent brute-force attacks by locking out account, and I see this kind of advice in several places (blocking by source IP after failed logins, ...
- 23
1
vote
1
answer
1k
views
What are the disadvantages of using Shamir's Secret Sharing to implement a Partial Password scheme?
Suppose I want to implement a partial password scheme, where the user authenticates by using two passwords: one a normal password, the other is partial, where he only needs to type the selected three ...
user123540
2
votes
2
answers
2k
views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
- 373
4
votes
1
answer
9k
views
Should user account be locked after X amount of failed logins?
I have almost finished developing my login system and there is one more thing that I'm not sure about. So many debates I found on the internet about counting invalid logins and locking users account. ...
- 141
1
vote
1
answer
2k
views
How secure is Asus router's brute-force protection?
I have just updated my RT-N12 D1 router to the latest firmware, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and ...
- 11
28
votes
4
answers
11k
views
Should I implement incorrect password delay in a website or a webservice?
With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
- 3,689
0
votes
1
answer
320
views
Prevent brute force attacks on web publishing logins
Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc.
But what about the web publishing logins (Web-Deploy, ...
- 793
4
votes
1
answer
17k
views
how to get cookies from aspx site to use it with hydra
I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.
...
- 43
2
votes
2
answers
768
views
Temporarily save failed logins password hashes for using against brute force attack
My question is about online brute force attacks, that try to authenticate in the website.
1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
- 485
2
votes
2
answers
2k
views
User Account Guessing [duplicate]
I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices".
My thought is generally this is a trade-off between great user functionality/UX and security....
4
votes
4
answers
1k
views
Ethical brute force demo on a web login when knowing the password complexity requirements
We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks.
I wanted ...
- 203
30
votes
5
answers
3k
views
What are the security implications of storing password blacklist?
I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
- 553
10
votes
3
answers
7k
views
Can I spoof IP addresses when attempting to brute force a login?
I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
- 327
8
votes
5
answers
2k
views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
- 13.2k
139
votes
9
answers
348k
views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
- 16.2k